104 lines
2.4 KiB
YAML
104 lines
2.4 KiB
YAML
---
|
|
# Security playbook: iptables + fail2ban for all VMs
|
|
#
|
|
# Run: ansible-playbook -i inventory.ini playbooks/security.yml
|
|
#
|
|
# This playbook uses direct iptables rules instead of ufw to ensure
|
|
# bridge network traffic is properly blocked (ufw's before.rules allows
|
|
# ICMP before custom deny rules can take effect).
|
|
|
|
- name: Configure Security for All VMs
|
|
hosts: all
|
|
become: true
|
|
tasks:
|
|
# Load netfilter kernel modules (required on fresh VMs)
|
|
- name: Load netfilter kernel modules
|
|
community.general.modprobe:
|
|
name: "{{ item }}"
|
|
state: present
|
|
loop:
|
|
- ip_tables
|
|
- ip6_tables
|
|
- iptable_filter
|
|
- ip6table_filter
|
|
|
|
# Install security packages
|
|
- name: Install iptables and fail2ban
|
|
community.general.pacman:
|
|
name:
|
|
- iptables
|
|
- fail2ban
|
|
state: present
|
|
|
|
# Stop and disable ufw if present (migrating to iptables)
|
|
- name: Check if ufw is installed
|
|
command: pacman -Q ufw
|
|
register: ufw_check
|
|
ignore_errors: true
|
|
changed_when: false
|
|
|
|
- name: Stop ufw if running
|
|
systemd:
|
|
name: ufw
|
|
state: stopped
|
|
when: ufw_check.rc == 0
|
|
ignore_errors: true
|
|
|
|
- name: Disable ufw
|
|
systemd:
|
|
name: ufw
|
|
enabled: false
|
|
when: ufw_check.rc == 0
|
|
ignore_errors: true
|
|
|
|
# Deploy iptables rules
|
|
- name: Deploy iptables rules
|
|
template:
|
|
src: ../templates/iptables.rules.j2
|
|
dest: /etc/iptables/iptables.rules
|
|
mode: '0644'
|
|
notify: reload iptables
|
|
|
|
# Enable and start iptables service
|
|
- name: Enable and start iptables
|
|
systemd:
|
|
name: iptables
|
|
state: started
|
|
enabled: true
|
|
|
|
# Configure fail2ban
|
|
- name: Create fail2ban local config
|
|
copy:
|
|
dest: /etc/fail2ban/jail.local
|
|
content: |
|
|
[DEFAULT]
|
|
bantime = 1h
|
|
findtime = 10m
|
|
maxretry = 5
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = ssh
|
|
filter = sshd
|
|
backend = systemd
|
|
mode: '0644'
|
|
notify: restart fail2ban
|
|
|
|
# Enable fail2ban service
|
|
- name: Enable and start fail2ban
|
|
systemd:
|
|
name: fail2ban
|
|
state: started
|
|
enabled: true
|
|
|
|
handlers:
|
|
- name: reload iptables
|
|
systemd:
|
|
name: iptables
|
|
state: restarted
|
|
|
|
- name: restart fail2ban
|
|
systemd:
|
|
name: fail2ban
|
|
state: restarted
|